{"id":137924,"date":"2025-06-21T23:12:01","date_gmt":"2025-06-21T21:12:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda"},"modified":"2025-06-21T23:12:01","modified_gmt":"2025-06-21T21:12:01","slug":"uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","title":{"rendered":"Zranite\u013enosti v kni\u017enici libxml2, potenci\u00e1lne ved\u00face k vykonaniu k\u00f3du","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V kni\u017enici Libxml2, ktor\u00e1 je vyv\u00edjan\u00e1 projektom GNOME a pou\u017e\u00edva sa na anal\u00fdzu obsahu vo form\u00e1te XML, bolo zisten\u00fdch 5 zranite\u013enost\u00ed, z ktor\u00fdch dve m\u00f4\u017eu potenci\u00e1lne vies\u0165 k vykonaniu k\u00f3du pri spracovan\u00ed \u0161peci\u00e1lne pripraven\u00fdch extern\u00fdch d\u00e1t. Kni\u017enica Libxml2 je \u0161iroko pou\u017e\u00edvan\u00e1 v open-source projektoch a napr\u00edklad sl\u00fa\u017ei ako z\u00e1vislos\u0165 v viac ne\u017e 800 bal\u00edkoch v Ubuntu. <\/p>\n

Prv\u00e1 zranite\u013enos\u0165 (CVE-2025-6170) je sp\u00f4soben\u00e1 prete\u010den\u00edm bufferu v implement\u00e1cii interakt\u00edvnej shelly xmllint, ktor\u00e1 sl\u00fa\u017ei na anal\u00fdzu XML s\u00faborov. Prete\u010denie nast\u00e1va pri spracovan\u00ed ve\u013emi dlh\u00fdch argumentov pr\u00edkazu kv\u00f4li neexistencii spr\u00e1vnej kontroly ve\u013ekosti vstupn\u00fdch d\u00e1t pred kop\u00edrovan\u00edm \u00fadajov pomocou funkcie strcpy(). Na vyu\u017eitie tejto zranite\u013enosti mus\u00ed \u00fato\u010dn\u00edk ma\u0165 mo\u017enos\u0165 ovplyvni\u0165 pr\u00edkazy pren\u00e1\u0161an\u00e9 do utility xmllint. Z\u00e1plata na odstr\u00e1nenie zranite\u013enosti zatia\u013e nie je k dispoz\u00edcii. <\/p>\n

Druh\u00e1 zranite\u013enos\u0165 (CVE-2025-6021) sa nach\u00e1dza v implement\u00e1cii funkcie xmlBuildQName() a vedie k z\u00e1pisu \u00fadajov mimo bufferu kv\u00f4li celo\u010d\u00edseln\u00e9mu prete\u010deniu pri v\u00fdpo\u010dte ve\u013ekosti bufferu na z\u00e1klade prefixu a lok\u00e1lneho mena. Na vyu\u017eitie tejto zranite\u013enosti mus\u00ed \u00fato\u010dn\u00edk dosiahnu\u0165, aby sa jeho \u00fadaje nahradili v argumentoch prefix a ncname odovzd\u00e1van\u00fdch funkcii xmlBuildQName(). Na odstr\u00e1nenie zranite\u013enosti bola pripraven\u00e1 z\u00e1plata. Oprava je zahrnut\u00e1 v verzii libxml2 2.14.4. Stav novej verzie bal\u00edka alebo pripravenie opravy v distrib\u00faci\u00e1ch mo\u017eno overi\u0165 na nasleduj\u00facich str\u00e1nkach (ak str\u00e1nka nie je dostupn\u00e1, znamen\u00e1 to, \u017ee v\u00fdvoj\u00e1ri distrib\u00facie e\u0161te neza\u010dali zva\u017eovanie probl\u00e9mu): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo a Arch (1, 2). <\/p>\n

Ostatn\u00e9 tri probl\u00e9my ved\u00fa k hav\u00e1rii kv\u00f4li pr\u00edstupu k u\u017e uvo\u013enenej oblasti pam\u00e4te vo funkcii xmlSchematronGetNode (CVE-2025-49794), dereferencovaniu nulov\u00e9ho ukazovate\u013ea vo funkcii xmlXPathCompiledEval (CVE-2025-49795) a nespr\u00e1vnemu spracovaniu typov (Type Confusion) vo funkcii xmlSchematronFormatReport (CVE-2025-49796). Na odstr\u00e1nenie t\u00fdchto zranite\u013enost\u00ed sa zva\u017euje mo\u017enos\u0165 odstr\u00e1nenia podpory jazyka zna\u010dkovania Schematron z kni\u017enice libxml2. <\/p>\n

\u010eal\u0161\u00edm faktom je existencia troch neopravnen\u00fdch zranite\u013enost\u00ed v kni\u017enici libxslt, ktor\u00e1 zostala bez podpory. Inform\u00e1cie o t\u00fdchto probl\u00e9moch zatia\u013e neboli zverejnen\u00e9 a publik\u00e1cia je pl\u00e1novan\u00e1 na 9. j\u00fala, 13. j\u00fala a 6. augusta. Neopravnen\u00e9 a verejne nezverejnen\u00e9 zranite\u013enosti s\u00fa tie\u017e zaznamenan\u00e9 v s\u00favisiacich projektoch GNOME, ako s\u00fa gvfs, libgxps, gdm, glib, GIMP a libsoup. <\/p>\n

Doplnok: Poskytovate\u013e libxml2 ozn\u00e1mil, \u017ee zo zranite\u013enost\u00ed sa bud\u00fa pova\u017eova\u0165 za be\u017en\u00e9 chyby bez zv\u00fd\u0161enej priority, opravova\u0165 sa bud\u00fa, ke\u010f bude \u010das, a okam\u017eite zverejnia inform\u00e1cie o podstate zranite\u013enosti bez zavedenia embarga a poskytnutia \u010dasu na opravu v extern\u00fdch produktoch.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Libxml2, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c GNOME \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XML, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u0411\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 Libxml2 \u0448\u0438\u0440\u043e\u043a\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445 \u0438, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 800 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 \u0438\u0437 \u0441\u043e\u0441\u0442\u0430\u0432\u0430 Ubuntu. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-6170) […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-137924","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enosti v kni\u017enici libxml2, ktor\u00e9 m\u00f4\u017eu potenci\u00e1lne vies\u0165 k vykonaniu k\u00f3du | ProHoster","description":"V kni\u017enici Libxml2, vyv\u00edjenej projektom GNOME a pou\u017e\u00edvanej na anal\u00fdzu obsahu vo form\u00e1te XML, bolo odhalen\u00fdch 5 zranite\u013enost\u00ed, z ktor\u00fdch dve m\u00f4\u017eu potenci\u00e1lne vies\u0165 k vykonaniu k\u00f3du pri spracovan\u00ed \u0161peci\u00e1lne pripraven\u00fdch vstupov.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libxml2, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Libxml2, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c GNOME \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XML, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-biblioteke-libxml2-potenczialno-privodyashhie-k-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-06-21T21:12:01+00:00","article:modified_time":"2025-06-21T21:12:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"137924","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:23:11","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:23:11","updated":"2026-01-23 13:23:11","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/137924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=137924"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/137924\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=137924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=137924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=137924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}